Liferay

Dxp

154 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
6.1

CVE-2022-28979

  • EPSS 0.47%
  • Veröffentlicht 22.09.2022 00:15:09
  • Zuletzt bearbeitet 27.05.2025 20:15:22

Liferay Portal v7.1.0 through v7.4.2 and Liferay DXP 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 was discovered to contain a cross-site scripting (XSS) vulnerability in the Portal Search module's Custom Facet widget....

6.1

CVE-2022-28982

  • EPSS 0.4%
  • Veröffentlicht 22.09.2022 00:15:09
  • Zuletzt bearbeitet 27.05.2025 18:15:28

A cross-site scripting (XSS) vulnerability in Liferay Portal v7.3.3 through v7.4.2 and Liferay DXP v7.3 before service pack 3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the name of a tag.

7.5

CVE-2021-33321

  • EPSS 0.31%
  • Veröffentlicht 03.08.2021 19:15:08
  • Zuletzt bearbeitet 21.11.2024 06:08:41

Insecure default configuration in Liferay Portal 6.2.3 through 7.3.2, and Liferay DXP before 7.3, allows remote attackers to enumerate user email address via the forgot password functionality. The portal.property login.secure.forgot.password should b...

6.1

CVE-2021-29049

  • EPSS 0.28%
  • Veröffentlicht 09.06.2021 19:15:09
  • Zuletzt bearbeitet 13.05.2025 18:17:51

Cross-site scripting (XSS) vulnerability in the Portal Workflow module's edit process page in Liferay DXP 7.0 before fix pack 99, 7.1 before fix pack 23, 7.2 before fix pack 12 and 7.3 before fix pack 1, allows remote attackers to inject arbitrary we...

6.1

CVE-2021-29048

  • EPSS 0.26%
  • Veröffentlicht 17.05.2021 12:15:07
  • Zuletzt bearbeitet 13.05.2025 18:17:51

Cross-site scripting (XSS) vulnerability in the Layout module's page administration page in Liferay Portal 7.3.4, 7.3.5 and Liferay DXP 7.2 before fix pack 11 and 7.3 before fix pack 1 allows remote attackers to inject arbitrary web script or HTML vi...

6.1

CVE-2021-29051

  • EPSS 0.23%
  • Veröffentlicht 17.05.2021 12:15:07
  • Zuletzt bearbeitet 13.05.2025 18:17:51

Cross-site scripting (XSS) vulnerability in the Asset module's Asset Publisher app in Liferay Portal 7.2.1 through 7.3.5, and Liferay DXP 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 1 allows remote attackers to inject arbit...

4.3

CVE-2021-29052

  • EPSS 0.08%
  • Veröffentlicht 17.05.2021 12:15:07
  • Zuletzt bearbeitet 21.11.2024 06:00:36

The Data Engine module in Liferay Portal 7.3.0 through 7.3.5, and Liferay DXP 7.3 before fix pack 1 does not check permissions in DataDefinitionResourceImpl.getSiteDataDefinitionByContentTypeByDataDefinitionKey, which allows remote authenticated user...

5.9

CVE-2021-29043

  • EPSS 0.2%
  • Veröffentlicht 17.05.2021 11:15:07
  • Zuletzt bearbeitet 13.05.2025 18:17:51

The Portal Store module in Liferay Portal 7.0.0 through 7.3.5, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 1 does not obfuscate the S3 store's proxy password, which allows attackers t...

6.1

CVE-2021-29044

  • EPSS 0.26%
  • Veröffentlicht 17.05.2021 11:15:07
  • Zuletzt bearbeitet 13.05.2025 18:17:51

Cross-site scripting (XSS) vulnerability in the Site module's membership request administration pages in Liferay Portal 7.0.0 through 7.3.5, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pac...

6.1

CVE-2021-29045

  • EPSS 0.28%
  • Veröffentlicht 17.05.2021 11:15:07
  • Zuletzt bearbeitet 21.11.2024 06:00:35

Cross-site scripting (XSS) vulnerability in the Redirect module's redirection administration page in Liferay Portal 7.3.2 through 7.3.5, and Liferay DXP 7.3 before fix pack 1 allows remote attackers to inject arbitrary web script or HTML via the _com...